As you may recall from the previous information we shared, the Law on Protection of Personal Data (“Law”) entered into force on April 07, 2016. Your company will be subject to this Law as it is engaged in processing of personal data. In this respect, you should already have taken steps to become compliant with the Law and you must register with the Data Controller Registry (“VERBİS”) on or before 31.12.2019 (unless exceptions detailed below apply to your company).

* Exceptions – The following are exempt from the obligation to register with VERBİS:

  • Real/legal persons with both (i) less than 50 employees annually and (ii) a total annual balance sheet of less than TRY 25 million (provided that the main activity is not the processing of sensitive personal data).
  • Customs brokers and mediators.
  • Independent financial advisers and certified public accountants.
  • Notaries and lawyers.
  • Political parties.

Becoming fully compliant with the Law prior to completion of VERBİS registration is important, as information will be requested during the registration including the type and category of processed personal data as well as the technical and administrative measures taken related to the protection of that data.

Administrative fines of between TRY 29.410 and TRY 1.470.583 (these are the thresholds determined for 2019) may be imposed, if the obligation to register with VERBİS is not fulfilled. Additional significant administrative fines may also be imposed related to breaches of certain other liabilities within the scope of the Law. If you would like to discuss this, or would like to request further information, please contact Batuhan Şahmay via email: [email protected]